TrustSight

Audits AUR PKGBUILDs before you update: catches careless malice and structural risk, and tells you what it can't verify.

The 30-second example

trustsight review

                        TrustSight Review
┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Package         ┃ Risk Score   ┃ Verdict                                   ┃
┃                 ┃              ┃                                           ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ chez-scheme-bin │   0/100      │ Version bump. No structural changes.      │
├─────────────────┼──────────────┼───────────────────────────────────────────┤
│ sketchy-pkg     │  35/100      │ R004 HIGH  Checksum disabled (SKIP).      │
│                 │              │ C003 INFO  Source URL changed without     │
│                 │              │            version bump.                  │
│                 │              │ SOURCE_BUCKET MEDIUM  New domain:         │
│                 │              │   sketchy-cdn.invalid (unknown).          │
│                 │              │ NOVELTY HIGH  Source URL first seen       │
│                 │              │   globally.                               │
│                 │              │ PINNING INFO  Source pinning: unpinned.   │
│                 │              │ Verdict: Checksum disabled; sources       │
│                 │              │   replaced with content from an unknown,  │
│                 │              │   never-before-seen domain.               │
├─────────────────┼──────────────┼───────────────────────────────────────────┤
│ obsidian-beta   │  15/100      │ INCONCLUSIVE. Only 2 prior observations;  │
│                 │              │ no high-severity signals from a cold DB.  │
└─────────────────┴──────────────┴───────────────────────────────────────────┘

The tiered evidence display is the differentiator: every signal (rule, bucket, novelty, pinning, verification) is shown with its contribution and severity. You see why the score is what it is.

What it catches / what it can't

Detected by TrustSight	Outside TrustSight's scope
Careless malice: `curl \| bash`, `base64 \| sh`, wget pipe sh (R001 recall ~100%). Obfuscated casing, embedded URLs in function bodies.	Signed upstream payload: the PKGBUILD is not the binary. A benign build file can fetch a tampered release tarball.
Structural risk: checksums disabled (R004), checksums emptied (R005), URL typosquatting (`githab.com`), source URLs swapped without a version bump (C003).	Deliberately-unremarkable PKGBUILDs: no added commands, no new URLs, no checksum changes; no signal. The update is invisible to diff analysis.
Anomaly-vs-history: first-seen URLs (global or per-package), first-seen maintainer, low-observation-count gating with INCONCLUSIVE verdict.	Build-dependency attacks: a malicious `makedepends` or `depends` is outside PKGBUILD scope. TrustSight audits the recipe, not the supply chain's second-order dependencies.
Reviewer manipulation: Unicode bidi overrides (R013, 88% recall) that make displayed text differ from executed text. Prompt injection in comments/descriptions (R012, 17% recall; kept as tripwire; primary defense is verdict-integrity assertions).	Unpinned sources result in INCONCLUSIVE. A `source=($pkgname-$pkgver.tar.gz)` with no checksum, tag, or commit pin is reported as structurally weak, not silently accepted.

Install

git clone https://github.com/emiliano-go/trustsight.git
cd trustsight/packaging/aur
makepkg -si

Not published to the AUR yet. Build from the PKGBUILD in this repository, as above.

The PKGBUILD runs the full test suite during build and installs the dependencies (pygit2, tldextract, rich, openai, typer) as pacman-tracked system packages.

Requires Python 3.10+.

Commands

Command	What it does
`trustsight review`	Scan outdated AUR packages and produce a scored table with tiered evidence. Supports `--repo`, `--foreign`, `--all-repos` flags and config-driven multi-repo discovery.
`trustsight inspect <package>`	Deep-dive on a single package: full score breakdown, source URLs, resolved commands, novelty context.
`trustsight history <package>`	Show past analysis results for a package, with optional `--score-breakdown`.
`trustsight seed-db`	Import the bundled novelty seed (178,491 AUR source URLs) so a fresh install is not cold. Runs automatically on first use.
`trustsight lint-rules`	Check `rules.toml` for unreachable, over-broad or malformed rules. Exits non-zero on errors, for use in CI.
`trustsight config`	Show configuration, set LLM keys, and run `sync-rules` to receive newly shipped detection rules.

How scoring works

Scoring is deterministic: same input always produces the same score. A core of 13 detection rules (R001 to R013), an expanded set (R039 to R059) calibrated against a 3,322-diff benign corpus, and 7 code-structure rules (C001 to C007) produce signals across four evidence tiers: A (structural, rules on PKGBUILD lines), B (priors/context, URL classification and forge trust), C (history/novelty, first-seen URLs and maintainers gated by observation count), and D (verification, checksums, PGP keys, GPG verify, which subtract from the score). The LLM is entirely optional and never calculates; it translates the deterministic breakdown into English, and verdict-integrity assertions gate its output. See scoring-philosophy.md.

Security model

TrustSight is evidence-producing, not proof-of-safety. It audits and does not install. The tool never runs the PKGBUILD, never executes extracted commands, and never modifies your system. Every finding is traceable to a specific diff line, URL, or novelty record. The output is a structured risk assessment to inform your decision, not a gate. See trust-model.md.

License

MIT

Documentation hub

Section	Description
Getting Started	One-tutorial path from install to first review
Full documentation	Docs landing page
Contributing	How to report bugs, contribute code, improve docs
Security	Vulnerability disclosure policy
License	MIT full text

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

trustsight-0.7.0.tar.gz (24.1 MB view details)

Uploaded Jul 26, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

trustsight-0.7.0-py3-none-any.whl (20.9 MB view details)

Uploaded Jul 26, 2026 Python 3

File details

Details for the file trustsight-0.7.0.tar.gz.

File metadata

Download URL: trustsight-0.7.0.tar.gz
Upload date: Jul 26, 2026
Size: 24.1 MB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for trustsight-0.7.0.tar.gz
Algorithm	Hash digest
SHA256	`b41bf58531440d1a1bbb2240bc57c3a5cf160a4de80cdd6c017b564026cf3ed7`
MD5	`605e3103676f62b66505d4b66531bf51`
BLAKE2b-256	`1f92b6a2b13e3c99992b1dca6129acfbb107b272fcf97c3d2e4584cc0fd8cbb8`

See more details on using hashes here.

Provenance

The following attestation bundles were made for trustsight-0.7.0.tar.gz:

Publisher: publishing.yml on emiliano-go/trustsight

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: trustsight-0.7.0.tar.gz
- Subject digest: b41bf58531440d1a1bbb2240bc57c3a5cf160a4de80cdd6c017b564026cf3ed7
- Sigstore transparency entry: 2255725657
- Sigstore integration time: Jul 26, 2026
Source repository:
- Permalink: emiliano-go/trustsight@fa8a32f4d2935b5d149770cd5353b859596b5b11
- Branch / Tag: refs/tags/v0.7.0
- Owner: https://github.com/emiliano-go
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publishing.yml@fa8a32f4d2935b5d149770cd5353b859596b5b11
- Trigger Event: release